Privacy Policy

01Information We Collect

To provide the platform, CyberaHAT collects only the information needed to run your account and its features:

• Account details you provide at registration — your full name, email address, and a password (stored only as a bcrypt hash, never in plain text).
• Learning activity — the courses, lessons, labs, quizzes, and study guides you use, along with quiz results and per-topic mastery used to build your learning profile.
• Security-assessment data — targets you submit for scanning, the resulting findings, risk scores, and generated reports.
• Operational records — audit logs of sensitive actions (such as authentication and role changes) and basic technical data needed to keep the service running.

02How We Use Your Information

Your information is used solely to operate and improve your experience on the platform, including to:

• Authenticate you and secure your account.
• Deliver core features — courses, labs, quizzes, study guides, scans, and reports.
• Personalize learning through your AI profile, mastery tracking, and adaptive recommendations.
• Generate AI-assisted content (hints, study guides, quiz questions, and report narratives) via the configured AI provider.
• Provide instructors and administrators with aggregate analytics about learning progress.

03AI Processing

Certain features use an AI model (Gemma, accessed through the Google AI Studio API) to generate content such as hints, study guides, quiz questions, and report summaries. Relevant context — for example a topic, a lab command, or scan findings — may be sent to the AI provider to produce these responses.

You should avoid submitting sensitive personal data into free-text AI features, as that content is processed to generate a response.

04Data Sharing

We do not sell your personal information. Data is shared only as necessary to run the platform — for example with the AI provider to generate AI features, and within your organization with instructors or administrators who have the appropriate role. We may disclose information where required by law.

05Security

We apply reasonable technical safeguards to protect your data, including:

• Passwords hashed with bcrypt.
• Authentication via JSON Web Tokens with refresh-token rotation.
• Role-based access control limiting who can perform sensitive actions such as scanning.
• Isolated, ephemeral containers for labs and security scans.
• Audit logging of sensitive operations.

06Your Rights

Subject to applicable law, you may:

• Access the personal information associated with your account.
• Request correction of inaccurate account details.
• Request deletion of your account and associated data.
• Withdraw consent for optional processing where consent is the legal basis.

07Data Retention

We retain your information for as long as your account is active or as needed to provide the platform. When you request deletion, we remove or anonymize your personal data except where retention is required for legal or security reasons.

08Contact Us

If you have questions about this Privacy Policy or your data, contact the team at chat.haroonrashid.me@gmail.com, or through the project repository on GitHub.